CVE-2017-20122: Bitrix Site Manager Contact Form cross site scripting
A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the component Contact Form. The manipulation of the argument text with the input <img src="http://1"; on onerror="$(’p').text(’Hacked’)" /> leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20122?
The severity of CVE-2017-20122 is medium with a score of 5.4.
How does CVE-2017-20122 affect Bitrix Site Manager?
CVE-2017-20122 affects Bitrix Site Manager version 12.06.2015.
What is the CWE classification for CVE-2017-20122?
CVE-2017-20122 is classified under CWE-79 and CWE-80.
What is the reference for CVE-2017-20122?
The references for CVE-2017-20122 are: [http://seclists.org/fulldisclosure/2017/Feb/3](http://seclists.org/fulldisclosure/2017/Feb/3) and [https://vuldb.com/?id.96643](https://vuldb.com/?id.96643)
How can CVE-2017-20122 be exploited?
CVE-2017-20122 can be exploited by manipulating the text argument of the Contact Form component with malicious input containing an image tag that triggers arbitrary code execution.